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DETAILED ACTION 
Claim Rejections - 35 USC § 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the 
rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

2. Claims 1 , 4-5, 23-24, 37, 39-40, 46-47 and 50 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Carrott et al, U.S. Patent No. 6,839,692 B2. 



As per Claim 1 . Carrott et al disclose a method involving a presenter, a trusted party, and an 
acceptor for validating profile data of said presenter during an on-line transaction comprising: 

- receiving said profile data at said trusted party (Col. 2, lines 5-10; Col. 3, lines 4-10; Col. 4, 
lines 8-18; Col. 5, lines 25-38 and 55-67; Col. 6, lines 60-65); 

- comparing said profile data against reference data stored by said trusted party (Col. 2, lines 5- 
10 and 20-33; Col. 3, lines 4-10; Col. 7, lines 4-10 and 17-25); 

- notifying said acceptor by said trusted party that said profile data of said presenter is either 
authentic or erroneous, whereby said trusted party validates said profile data of said presenter for the 
benefit of said acceptor (Col. 2, lines 5-10 and 20-33; Col. 7, lines 24-42). 

As per Claims 4-5 , Carrott et al further disclose wherein the presenter and the acceptor 
communicate with said trusted party over the Internet (Abstract; Figure 1; Col. 3, lines 45-55; Col. 8, lines 
10-15). 



As per Claims 23-24 , Carrott et al further disclose providing, by the trusted party, of updated 
profile data when the profile data is determined to be out of date (Col. 2, lines 25-33). 



Application/Control Number: 10/660,263 



Art Unit: 3621 



Page 3 



As per Claim 37 . Carrott et al disclose a method involving a presenter, a trusted party, and an 
acceptor for providing at least some profile data of said presenter during an on-line transaction to said 
acceptor comprising: 

- querying said trusted party by said acceptor for said trusted party to provide said profile data to 
said acceptor (Figure 2; Col. 2, lines 20-33; Col. 5 line 60-Col. 6 line 3; Col. 7, lines 24-34); and 

- providing profile data of said presenter, by said trusted party, to said acceptor (Col. 2, lines 20- 
33; CoL 5 line 60-Col. 6 line 3; Col. 7, lines 24-34). 

As per Claims 39-40 . Carrott et al further disclose wherein the presenter, acceptor and trusted 
party communicate over the Internet (Abstract; Figure 1; Col. 3, lines 45-55; Col. 8, lines 10-15). 

As per Claim 46 . Carrott et al further disclose wherein the identity and profile data include at least 
the name and address of the presenter (Col. 2, lines 20-33; Col. 5 line 60-Col. 6 line 3; Col. 7, lines 24- 
34). 

As per Claims 47 and 50 . Carrott et al further disclose transmitting a data authentication request 
message from said acceptor to said trusted party in order to request that said trusted party provide said 
profile data of said presenter (Figure 2; Col. 2, lines 20-33; Col. 5 line 60-Col. 6 line 3; Col. 7, lines 24- 
34); and transmitting a data authentication response message from said trusted party to said acceptor, 
said data authentication response message containing said profile data of said presenter (Col. 2, lines 20- 
33; Col. 5 line 60-Col. 6 line 3; Col. 7, lines 24-34). 



Claim Rejections - 35 USC § 103 
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3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness rejections 

set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 2-3, 6-22, 25-36, 38, 41-45, 48-49 and 51-54 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Carrott et al, U.S. Patent No. 6,839,692 B2 in view of Lake et al, U.S. Patent 
Application Publication No. US 2002/0091646 A1. 

As per Claims 2. 38 and 41 . Carrott et al further disclose local user authentication wherein the 
user inputs a user ID and password which is then verified by the users computer prior to proceeding (Col. 

5. lines 57-63; Col. 6, lines 20-25). Carrott et al, however, fail to explicitly disclose receiving 
authentication data at a trusted party, comparing the authentication data against pre-designated 
authenticating data previously designated for the user and notifying the acceptor that the identity of the 
presenter is authentic for the benefit of the acceptor. Lake et al disclose a method for verifying the 
identity of on-line credit card purchasers and further teach receiving, at a trusted party, authenticating 
data from the presenter (0006-0008; 001 1; 0028; 0037); comparing, by the trusted party, the 
authenticating data against pre-designated authenticating data previously designated for the presenter 
(0021; 0022; 0024; 0025; 0028; 0033; 0035; 0036; 0038) and notifying the acceptor by the trusted party 
that the identity of the presenter is either authentic or erroneous, whereby the trusted party authenticates 
the identity of the presenter for the benefit of the acceptor (0024; 0025; 0036; 0038). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's invention to modify the method of 
Carrott et al and include authenticating the identity of the purchaser as taught by Lake et al so that the 
merchant is ensured that the purchaser is the authorized user for the credit card. Lake et al provides 
motivation by indicating that there is a need for a method or system for verifying the identity of an on-line 
purchaser, and ensuring to a reasonable extent that the purchaser is in fact the party authorized to use 
the credit card presented for payment (0005). 
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As per Claims 3 and 6, Carrott et al further disclose notifying the acceptor that the profile data is 
authentic when the profile data matches the reference data (Col. 2, lines 5-10 and 20-33; Col. 7, lines 24- 
42). Carrott et al, however, fail to explicitly disclose notifying the acceptor that the identity is authentic 
when the authenticating data received from the presenter matches the pre-designated authenticating 
data. Lake et al disclose a method for verifying the identity of on-line credit card purchasers and further 
teach notifying the acceptor that the identity is authentic when the data matches (0024; 0025; 0036; 
0038). It would have been obvious to one of ordinary skill in the art at the time of applicant's invention to 
modify the method of Carrott et al and include authenticating the identity of the purchaser as taught by 
Lake et al so that the merchant is ensured that the purchaser is the authorized user for the credit card. 
Lake et al provides motivation by indicating that there is a need for a method or system for verifying the 
identity of an on-line purchaser, and ensuring to a reasonable extent that the purchaser is in fact the party 
authorized to use the credit card presented for payment (0005). 

As per Claims 7-8 and 42-43 . Carrott et al fail to disclose, however, Lake et al disclose receiving 
and storing authenticating data from the presenter at the trusted party wherein the authenticating data 
becomes the pre-designated authenticating data (0007). It would have been obvious to one of ordinary 
skill in the. art at the time of applicant's invention to modify the method of Carrott et al and include 
receiving and storing, at the trusted party, authenticating data of the purchaser as pre-designated 
authenticating data for purposes of authenticating the identity of the purchaser as taught by Lake et al so 
that the merchant is ensured that the purchaser is the authorized user for the credit card. Lake et al 
provides motivation by indicating that there is a need for a method or system for verifying the identity of 
an on-line purchaser, and ensuring to a reasonable extent that the purchaser is in fact the party 
authorized to use the credit card presented for payment (0005). 

As per Claims 9-10 and 44-45 . Carrott et al fail to disclose, however, Lake et al disclose 
providing, by the trusted party, to the presenter a program identity number which is correlated with the 
identity, profile data and authenticating data and storing the program identity number by the trusted party 
(0007; 0031 ; 0038). It would have been obvious to one of ordinary skill in the art at the time of applicant's 
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invention to modify the method of Carrott et al and include a program identity number such as an account 
number, unique identifier or other code of some sort issued and stored by the trusted party so that the 
trusted party has a unique number or code associated with the presenter as taught by Lake et al and 
which may be used later to identify the presenter or an account maintained by the trusted party. 

As per Claims 11-12 and 14-17 . Carrott et al further disclose initiating communications between 
the presenter and acceptor and receiving profile data and a program identity number at the acceptor for 
the presenter (Col. 4, lines 5-18; CoL 5, lines 25-38). Carrott et al, however, fail to explicitly disclose 
receiving identity data at the acceptor. Lake et al disclose a method for verifying the identity of on-line 
credit card purchasers and further teach receiving, at a trusted party, authenticating data from the 
presenter (0006-0008; 001 1; 0028; 0037); comparing, by the trusted party, the authenticating data 
against pre-designated authenticating data previously designated for the presenter (0021; 0022; 0024; 
0025; 0028; 0033; 0035; 0036; 0038) and notifying the acceptor by the trusted party that the identity of 
the presenter is either authentic or erroneous, whereby the trusted party authenticates the identity of the 
presenter for the benefit of the acceptor (0024; 0025; 0036; 0038). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to modify the method of Carrott et al and include 
authenticating the identity of the purchaser as taught by Lake et al so that the merchant is ensured that 
the purchaser is the authorized user for the credit card. Lake et al provides motivation by indicating that 
there is a need for a method or system for verifying the identity of an on-line purchaser, and ensuring to a 
reasonable extent that the purchaser is in fact the party authorized to use the credit card presented for 
payment (0005). 

As per Claim 13 . Carrott et al further disclose querying the trusted party by the acceptor whether 
account data updating can be provided (Col. 2, lines 25-33). 

As per Claims 18 and 20-21. Carrott et al further disclose transmitting a data authentication 
request message from said acceptor to said trusted party in order to request that said trusted party 
validate said profile data of said presenter as discussed above. Carrott et al, however, fail to disclose 
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requesting that the third party authenticate the identity of the presenter. Lake et al disclose a method for 
requesting that the trusted party verifying the identity of on-line credit card purchasers and further teach 
notifying the acceptor that the identity is authentic when the data matches (0024; 0025; 0036; 0038). It 
would have been obvious to one of ordinary skill in the art at the time of applicant's invention to modify the 
method of Carrott et al and include authenticating the identity of the purchaser as taught by Lake et al so 
that the merchant is ensured that the purchaser is the authorized user for the credit card. Lake et al 
provides motivation by indicating that there is a need for a method or system for verifying the identity of 
an on-line purchaser, and ensuring to a reasonable extent that the purchaser is in fact the party 
authorized to use the credit card presented for payment (0005). 

As per Claims 19. 22. 48 and 51 . Carrott et al and Lake et al disclose transmitting a data 
authentication response message from the trusted party to the acceptor, however, fail to transmit this 
message via the presenter. Examiner takes Official Notice, however, that routing authentication response 
messages to an acceptor such as a merchant via a presenter such as a purchaser is well known in the art 
and it would have been obvious to one of ordinary skill in the art at the time of applicant's invention to 
route the message in this fashion depending upon the configuration and desired message routing. 

As per Claims 25. 27. 52 and 54 . Carrott et al disclose an on-line data authentication system 
comprising: 

- a trusted party who receives, validates and provides profile data of a presenter (Figure 1 ; Col. 
2, lines 5-10 and 20-33; Col. 3, lines 4-10; Col. 4, lines 8-18; Col. 5, lines 25-38 and 55-67; Col. 6, lines 
60-65; Col. 7, lines 4-10 and 17-25); ; 

- an acceptor who conducts a transaction with said presenter and who requests said trusted 
party to validate said profile data of said presenter (Figure 1; Col. 6, lines 60-67; Col. 7, lines 1-10); and 

a directory server configured to determine the existence of said trusted party who will be able to 
validate said profile data of said presenter (Col. 6, lines 60-67; Col. 7, lines 1-10). 

Carrott et al further disclose local user authentication wherein the user inputs a user ID and 
password which is then verified by the users computer prior to proceeding (Col. 5, lines 57-63; Col. 6, 
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lines 20-25). Carrott et al, however, fail to explicitly disclose receiving authentication data at a trusted 
party, and an acceptor requesting the trusted party to authenticate the identity of the presenter. Lake et 
al disclose a method for verifying the identity of on-line credit card purchasers and further teach receiving, 
at a trusted party, authenticating data from the presenter (0006-0008; 0011; 0028; 0037); comparing, by 
the trusted party, the authenticating data against pre-designated authenticating data previously 
designated for the presenter (0021 ; 0022; 0024; 0025; 0028; 0033; 0035; 0036; 0038) and notifying the 
acceptor by the trusted party that the identity of the presenter is either authentic or erroneous, whereby 
the trusted party authenticates the identity of the presenter for the benefit of the acceptor (0024; 0025; 
0036; 0038). It would have been obvious to one of ordinary skill in the art at the time of applicants 
invention to modify the method of Carrott et al and include authenticating the identity of the purchaser as 
taught by Lake et al so that the merchant is ensured that the purchaser is the authorized user for the 
credit card. Lake et al provides motivation by indicating that there is a need for a method or system for 
verifying the identity of an on-line purchaser, and ensuring to a reasonable extent that the purchaser is in 
fact the party authorized to use the credit card presented for payment (0005). 

As per Claims 26 and 53 . Carrott et al further disclose wherein the presenter and the acceptor 
communicate with said trusted party over the Internet (Abstract; Figure 1 ; Col. 3, lines 45-55; Col. 8, lines 
10-15). 

As per Claim 28 . Carrott et al fail to disclose, however, Lake et al disclose receiving and storing 
authenticating data from the presenter at the trusted party wherein the authenticating data becomes the 
pre-designated authenticating data (0007). It would have been obvious to one of ordinary skill in the art 
at the time of applicant's invention to modify the method of Carrott et al and include receiving and storing, 
at the trusted party, authenticating data of the purchaser as pre-designated authenticating data for 
purposes of authenticating the identity of the purchaser as taught by Lake et al so that the merchant is 
ensured that the purchaser is the authorized user for the credit card. Lake et al provides motivation by 
indicating that there is a need for a method or system for verifying the identity of an on-line purchaser, 
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and ensuring to a reasonable extent that the purchaser is in fact the party authorized to use the credit 
card presented for payment (0005). 

As per Claims 29-30 , Carrott et al fail to disclose, however, Lake et al disclose providing, by the 
trusted party, to the presenter a program identity number which is correlated with the identity, profile data 
and authenticating data and storing the program identity number by the trusted party (0007; 0031; 0038). 
It would have been obvious to one of ordinary skill in the art at the time of applicant's invention to modify 
the method of Carrott et al and include a program identity number such as an account number, unique 
identifier or other code of some sort issued and stored by the trusted party so that the trusted party has a 
unique number or code associated with the presenter as taught by Lake et al and which may be used 
later to identify the presenter or an account maintained by the trusted party. 

As per Claims 31-32 . Carrott et al disclose a request message transmitted from the acceptor to 
the trusted party via a directory server, the message containing a query as to whether the trusted party 
will be able to validate the profile data of the presenter (Col. 6, lines 45-67) and a response message for 
validating the profile data of the presenter (Col. 2, lines 5-10 and 20-33; Col. 7, lines 24-42). Carrott et al, 
however, fail to disclose transmitting a message to the third party querying the third party as to whether 
the third party will be able to authenticate the identity of the presenter. Lake et al disclose a method for 
requesting that the trusted party verifying the identity of on-line credit card purchasers and further teach 
notifying the acceptor that the identity is authentic when the data matches (0024; 0025; 0036; 0038). It 
would have been obvious to one of ordinary skill in the art at the time of applicant's invention to modify the 
method of Carrott et al and include authenticating the identity of the purchaser as taught by Lake et al so 
that the merchant is ensured that the purchaser is the authorized user for the credit card. Lake et al 
provides motivation by indicating that there is a need for a method or system for verifying the identity of 
an on-line purchaser, and ensuring to a reasonable extent that the purchaser is in fact the party 
authorized to use the credit card presented for payment (0005). 
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As per Claims 33-36 , Carrott et al disclose a request message transmitted from the acceptor to 
the trusted party via a directory server, the message requesting that the trusted party validate the profile 
data of the presenter, the request message including profile data of the presenter (Col. 2, lines 5-10; Col. 
3, lines 4-10; Col. 4, lines 8-18; Col. 5, lines 25-38 and 55-67; Col. 6, lines 60-65) and a response 
message for validating the profile data of the presenter and whether or not the profile data is accurate or 
contains errors (Col. 2, lines 5-10 and 20-33; Col. 7, lines 24-42). Carrott et al f however, fail to disclose 
transmitting a messaged the third party requesting that the third party authenticate the identity of the 
presenter. Lake et al disclose a method for requesting that the trusted party verifying the identity of on- 
line credit card purchasers and further teach notifying the acceptor that the identity is authentic when the 
data matches (0024; 0025; 0036; 0038). It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to modify the method of Carrott et al and include authenticating the 
identity of the purchaser as taught by Lake et al so that the merchant is ensured that the purchaser is the 
authorized user for the credit card. Lake et al provides motivation by indicating that there is a need for a 
method or system for verifying the identity of an on-line purchaser, and ensuring to a reasonable extent 
that the purchaser is in fact the party authorized to use the credit card presented for payment (0005). 

As per Claim 49 , Carrott et al fail to disclose, however, Lake et al disclose requesting the 
presenter, by the trusted party, for the authenticating data (0007; 001 1; 0024; 0028; 0031; 0038). Carrott 
et al, however, fail to disclose asking the presenter, by the trusted party, for permission to provide the 
profile data of the presenter to the acceptor. Examiner takes Official Notice, however, that utilizing a third 
party entity to essentially filter customer personal or profile data provided to merchants based on 
permissions controlled by the customer is well known in the art and it would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to modify the reference to Carrott et al and 
include the ability to filter the information provided to the merchant. One would have been motivated to 
filter this type of customer personal or profile data since it was well known at the time of applicant's 
invention that consumers were generally concerned about divulging personal or private information. 
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Double Patenting 

5. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in 
public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise 
extension of the "right to exclude" granted by a patent and to prevent possible harassment by multiple 
assignees. See In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 

F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); 
In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970);and, In re Thorington, 418 F.2d 528, 163 
USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) may be used to overcome 
an actual or provisional rejection based on a nonstatutory double patenting ground provided the 
conflicting application or patent is shown to be commonly owned with this application. See 37 
CFR 1.130(b). 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. 
A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b). 

6. Claims 1 , 25 and 52 are provisionally rejected under the judicially created doctrine of obviousness- 
type double patenting as being unpatentable over claim 7 of copending Application No. 09/842,313 in 
view of Carrott et al, U.S. Patent No. 6,839,692 B2. 

As per Claims 1-2, 25 and 52, claim 7 of copending application no. 09/842,313 recites all the 
claim limitations except for receiving and comparing profile data of the presenter and notifying an 
acceptor that the profile data is either authentic or erroneous. Carrott et al discloses these limitations in 
accordance with the discussion above. Accordingly, it would have been obvious to one having ordinary 
skill in the art at the time of applicant's invention to modify claim 7 of copending application no. 
09/842,313 and include receiving and comparing profile data of the presenter and notifying an acceptor 
that the profile data is either authentic or erroneous as taught by Carrott et al so that the acceptor can be 
assured that the information is correct before carrying out a transaction with the presenter. 

This is a provisional obviousness-type double patenting rejection. 



7. Claims 1 , 25 and 52 are provisionally rejected under the judicially created doctrine of obviousness- 
type double patenting as being unpatentable overclaim 1 of copending Application No. 10/156,271 in 
view of Carrott et al, U.S. Patent No. 6,839,692 B2. 

As per Claims 1-2, 25 and 52, claim 7 of copending application no. 10/156,271 recites all the 
claim limitations except for receiving and comparing profile data of the presenter and notifying an 
acceptor that the profile data is either authentic dr erroneous. Carrott et al discloses these limitations in 
accordance with the discussion above. Accordingly, it would have been obvious to one having ordinary 
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skill in the art at the time of applicant's invention to modify claim 7 of copending, application no. 
09/842,313 and include receiving and comparing profile data of the presenter and notifying an acceptor 
that the profile data is either authentic or erroneous as taught by Carrott et al so that the acceptor can be 
assured that the information is correct before carrying out a transaction with the presenter. 
This is a provisional obviousness-type double patenting rejection. 

Conclusion 

8. Examiner's Note: Examiner has cited particular columns and line numbers in the references as 
applied to the claims below for the convenience of the applicant. Although the specified citations are 
representative of the teachings in the art and are applied to the specific limitations within the individual 
claim, other passages and figures may apply as well. It is respectfully requested that the applicant, in 
preparing the responses, fully consider the references in entirety as potentially teaching all or part of the 
claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the 
examiner. 

9. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. 

• Kuo discloses a process and method for secure online transactions to reduce fraud by including a 
consumer authentication code which is verified by a host processor 

• Sixtus discloses a method for secure online transactions and teaches authenticating a users computer 
and therefore the user when carrying out transactions 
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10. Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to John Hayes whose telephone number is (703)306-5447. The examiner can normally be 
reached Monday through Friday from 5:30 to 3:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Jim 
Trammell, can be reached on (703) 305-9768. 

Any inquiry of a general nature or relating to the status of this application or proceeding should be 
directed to the receptionist whose telephone number is (703) 308-1 113. 

Any inquiry of a general nature or relating to the status of this application or proceeding should be 
directed to the Receptionist whose telephone number is (703) 305-3900. Information regarding the 
status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. 
Status information for published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://portal.uspto.Qov/external/portal/pair . Should you have 
questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866- 
217-9197 (toll-free). 

Please address mail to be delivered by the United States Postal Service (USPS) as follows: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(703) 872-9306 [Official communications; including 

After Final communications labeled 
"Box AF"] 

(703) 746-5531 [Informal/Draft communications, labeled 

"PROPOSED" or "DRAFT"] 

Hand delivered responses should be brought to Crystal Park 5, 2451 Crystal Drive, Arlington, 

-^th floor receptionist 
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